StepSecurity vs CRACI

The short answer

StepSecurity is a software supply chain security platform that covers four control points: developer machines, package registries, code repositories and CI/CD. Its CI/CD product, Harden-Runner, is an agent that watches every outbound connection, process and file write in a job, ties each one to the workflow step that caused it, and can block egress to anything not on an allowlist. Enterprise costs $16 per contributing developer per month, and public repositories on GitHub-hosted runners are free.

CRACI replaces the runner itself: its egress policy is enforced by the runner platform and validated before the job starts, and the same job produces a package-level SBOM. This is the closest overlap CRACI has with any security vendor, because both restrict what a build can reach. The difference is where the control lives. Harden-Runner secures runners you keep, including GitHub-hosted ones. CRACI's policy comes with being the runner, and it records packages rather than only destinations.

At a glance

"Not stated" means we could not confirm it in StepSecurity's public pages.

What StepSecurity does well

Harden-Runner

• Step-level visibility. Each outbound connection, file operation and process execution is mapped to the exact step, job and workflow where it happened. The Enterprise tier adds process arguments, file write paths, and alerts by email, Slack, Microsoft Teams or your SIEM.
• Audit first, then block. In egress-policy: audit mode Harden-Runner builds a baseline of each job's normal outbound calls and flags anything new. You can then switch to block mode with an allowlist of endpoints. A global block list of known-malicious domains, maintained by StepSecurity, applies even in audit mode.
• Tamper detection. It alerts on unexpected changes to source code during the build.
• Broad coverage. Full support on GitHub-hosted Linux runners, audit mode on GitHub-hosted Windows and macOS, and, on the Enterprise tier, self-hosted VMs, bare metal and Actions Runner Controller. StepSecurity also lists GitLab CI, Azure DevOps and third-party runners such as Blacksmith, Depot and Namespace. On self-hosted runners the agent is built into the runner image, so workflows need no changes.
• Track record. StepSecurity reports that Harden-Runner detected the tj-actions/changed-files compromise (CVE-2025-30066) and the compromised axios npm package, and that it secures over 25 million workflow runs a week. The community-tier agent is open source under Apache 2.0.

Where Harden-Runner runs

StepSecurity's own support matrix for GitHub Actions, as of September 2026:

It is not supported when a whole job runs in a container on GitHub-hosted runners, or on ubuntu-slim. On Actions Runner Controller, only Linux jobs are supported.

The rest of the platform

• Actions governance: an inventory of the third-party actions and reusable workflows you use, approval workflows for new ones, and StepSecurity Maintained Actions as reviewed drop-in replacements.
• Secure Registry: cooldown periods for new package versions, blocking of known-compromised versions, typosquat protection and org-wide blocklists, with one policy for laptops and CI.
• Code Repo Security: pull request checks, and Orchestrate Security, which opens pull requests that pin actions to commit SHAs, set least-privilege GITHUB_TOKEN permissions and roll out Dependabot configurations.
• Dev Machine Guard: an inventory of AI coding agents, MCP servers, IDE extensions and packages on developer machines.

Where CRACI is different

Being the runner, not an agent on it

On GitHub-hosted runners, Harden-Runner is installed by a step you add as the first step of each job, and its reach depends on what GitHub's infrastructure allows. None of that is a flaw in the product; it follows from running on infrastructure someone else owns.

CRACI's policy is part of the runner. It is validated before the job starts, rejects unknown fields, and fails closed, so a policy that cannot be applied does not produce an unprotected run. Runs still appear in GitHub, and moving a job is a change to its runs-on label.

Packages, not only destinations

Harden-Runner's allowlist is a list of endpoints, and its network insights show which hosts each step contacted. CRACI's sources are typed by ecosystem, with 24 built-in software-source presets, custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git over HTTPS and SSH, and explicit TLS, TCP, UDP and ICMP rules. A package-aware proxy records which packages each job fetched, including packages restored from CI caches, and produces a CycloneDX or SPDX SBOM with a completeness state per job and per cache.

After the build

• Provenance data comes back from the API along with SBOMs and network traces. CRACI does not sign provenance and claims no SLSA level.
• Monitoring re-evaluates the SBOMs of what you shipped as new vulnerabilities appear, and security teams triage findings and send them to the teams that own the fix.
• Inventory shows exactly which software versions are deployed to which products, globally, so a new vulnerability maps straight to the products that run the affected version.

Price

As of September 2026, StepSecurity's Community tier is free for unlimited public repositories on GitHub-hosted runners. The Enterprise tier costs $16 per month per contributing developer, meaning anyone who contributed to a secured repository in the last 90 days, and includes Dev Machine Guard and Secure Registry. Dev Machine Guard alone is $8 per device per month. Private repositories and self-hosted runners need Enterprise, both paid tiers have a 14-day free trial, and StepSecurity offers volume discounts. Harden-Runner secures runners you already pay for, so runner minutes are a separate cost.

CRACI charges only for build minutes: $0.002 per vCPU-minute ($0.004 for a default 2 vCPU runner), metered per second, with no monthly fee. Because CRACI is the runner, that price covers the compute as well as the evidence. See CRACI pricing for current terms.

Which one fits

StepSecurity is the better fit when

• You want to keep GitHub-hosted runners, including Windows and macOS.
• You run self-hosted runners, GitLab CI or Azure DevOps.
• You want to watch traffic in audit mode before you block anything.
• You need process and file-level visibility for incident response.
• Your open-source project runs on GitHub-hosted runners and needs a free option.

CRACI is the better fit when

• You want the runner and the egress policy in one place, with no agent to deploy.
• You need a package-level SBOM from each build, with a completeness state.
• You want monitoring of what shipped.
• You need CRA evidence, or EU data residency on CRACI's Enterprise plan.

What you give up by moving jobs to CRACI

To be plain about it: CRACI has no audit or monitor mode yet (it is on the roadmap), does not monitor processes or file writes, does not run on GitHub-hosted runners or other CI systems yet (GitLab CI and Jenkins are on the roadmap), has package blocklists only on its roadmap, and its alerts cover policy violations only, with no Slack, Teams or SIEM integration. If those are your priorities, StepSecurity covers them today.

StepSecurity's Secure Registry, Code Repo Security and Dev Machine Guard protect points CRACI does not touch: the registry your packages come from, your repositories, and developer laptops. They do not depend on the runner, so they are unaffected by where your jobs run.

For the Cyber Resilience Act

The Cyber Resilience Act asks manufacturers to know the components in their products, handle vulnerabilities in them, and keep evidence. StepSecurity focuses on preventing and detecting supply chain attacks, and its runtime insights help when you investigate an incident in CI. CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process: build-time SBOMs exported as CycloneDX or SPDX, vulnerability tracking, and provenance through the API. See CRA evidence.

Read more about CI/CD integration and build-time SBOM generation, or book a demo to see a job run under an egress policy on CRACI.

StepSecurity questions, answered

What is StepSecurity?

StepSecurity is a software supply chain security platform. Its best-known product, Harden-Runner, is an agent that monitors network egress, file integrity and process activity on CI/CD runners and can block egress outside an allowlist. The platform also covers package registries (Secure Registry), code repositories (Code Repo Security), developer machines (Dev Machine Guard) and threat intelligence.

How much does StepSecurity cost?

As of September 2026, the Community tier is free for unlimited public repositories. Enterprise is $16 per contributing developer per month, where a contributing developer is anyone who contributed to a secured repository in the last 90 days, and includes Dev Machine Guard and Secure Registry. Dev Machine Guard alone is $8 per device per month. Both paid tiers have a 14-day free trial, and runner minutes are a separate cost.

Is Harden-Runner free?

Yes, for public repositories on GitHub-hosted runners. Private repositories and self-hosted runners, including self-hosted runners for public repositories, need the Enterprise tier. The community-tier agent is open source under the Apache 2.0 license.

Which runners does Harden-Runner support?

GitHub-hosted Linux runners in audit and block mode, GitHub-hosted Windows and macOS runners in audit mode, and on Enterprise, self-hosted VMs, bare metal and Actions Runner Controller. StepSecurity also lists GitLab CI, Azure DevOps and third-party runners such as Blacksmith, Depot and Namespace. It is not supported when a whole job runs in a container on GitHub-hosted runners, or on ubuntu-slim.

What is the difference between StepSecurity and CRACI?

Harden-Runner is an agent you add to runners you keep. CRACI is the runner: its egress policy is enforced by the runner platform, validated before the job starts and fails closed, and every job also produces a package-level SBOM with a completeness state. StepSecurity is ahead on audit mode, process and file monitoring, and runner and CI coverage.

Can CRACI replace Harden-Runner?

For GitHub Actions jobs on Linux, yes: moving a job to CRACI gives it egress control from the runner itself, so no agent is needed on that job. You give up audit mode (on CRACI's roadmap), process and file monitoring, and coverage of GitHub-hosted, Windows, macOS and non-GitHub runners.

Does StepSecurity generate an SBOM?

Harden-Runner records the destinations, processes and files a job touched, not a package-level SBOM of the build. CRACI records which packages each job fetched, including packages restored from CI caches, and exports CycloneDX and SPDX.